Splunk Search

how to match partial string in search query

sravankaripe
Communicator

Hi

I have a errors in the field (say myfield)

Error xyz : 123
Error xyz : 456
Error xyz : 789
Error xyz : 135
Error xyz : 987

i want to group it by matching the partial values of a string like
| eval myfield=if(myfield=="Error xyz*","Error xyz",myfield)

So myfields should contain values

"Error xyz" and other errors
(i am tring to group myfield values which starts with "Error xyz" )
how can i do this

Tags (2)
0 Karma
1 Solution

SplunkersRock
Path Finder

try this

| eval temp= mvfilter(match(myfield,"Error xyz")) | eval myfield=if(myfield==temp,"Error xyz",myfield)

if it won't work, please provide me more info

View solution in original post

SplunkersRock
Path Finder

try this

| eval temp= mvfilter(match(myfield,"Error xyz")) | eval myfield=if(myfield==temp,"Error xyz",myfield)

if it won't work, please provide me more info

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...